use flake

$(sops decrypt --extract '["terraform"]' lib/secrets.yaml)
$(sops decrypt --extract '["cloudflare"]["backend"]["export"]' lib/terranix/secrets.yaml)
